The file format

Ops writes one NAME=value per line. A value is written bare unless it holds $, \, ", ', # or whitespace; then it is double quoted, with \\, \", \$ and \n as escapes. ops-env reads that back byte for byte, exactly as the Rust SDK does.

LOG_FORMAT=json
DATABASE_URL=postgres://web:p4ss@db:5432/rungholt
SIGNING_KEY="a\$b\\c"

A dollar sign is never expanded

Node's --env-file, Bun's own .env loading and dotenv-expand replace $NAME inside a value, and not all of them honour \$. A generated password holding $abc then becomes a different password. ops-env never expands anything: a bare value is taken as written, backslashes included. This is the reason to use it instead of --env-file.

Hand written files

For the .env you write yourself it also reads:

• blank lines and lines starting with #;
• an export prefix;
• single quoted values, taken literally;
• a # comment after a value;
• Windows line ends;
• double quoted values that span lines;
• \' and a backslash before a space inside double quotes.